OCR Labs’ hack-proof FBI technique behind Westpac and ANZ

The verification business behind ANZ, Westpac and St George bank products says its redaction services makes data breaches effectively useless.

The AI verification company that has lured St George Bank, Westpac and ANZ as customers is so confident in its security measures it says hackers who breach their clients will find nothing they can use.

OCR Labs has trained its system on more than 50 million synthetic images that differ in skin tone, face shape and features, among other subtle differences from eye colour to the shape of a person’s nose or facial hair.

However, it’s a simple security feature that leaves the business so confident in its operations that even if a hacker did breach its clients, they could not find anything of use.

That feature is an SaaS redaction product that it recommends to clients after a period of between 30 and 90 says.

“Just like an old FBI document, they would only see a photo of an identity document in our client’s system with black lines all over the top of it,” he said.

While OCR Labs Asia-Pacific general manager Paul Warren-Tape said he was not exactly inviting hackers to challenge the company’s security, customers of any newer client who had used the redaction service would be safe in the case of a breach.

The redaction service as well OCR Labs’ ability to produce up to 10 million images off of a simple data set was part of the reason it had won over two of Australia’s big four banks as clients.

OCR Labs APAC general manager Paul Warren-Tape.

OCR Labs was one of the first verification companies to receive a 100 per cent success rate in likeness testing in 2019, with a 0 per cent error rate.

It was also working with Australian ethical hacking firm Dvuln to constantly try to break its own systems.

“We have our systems penetration-tested from both an internal and external perspective by certified hackers,” he said.

While generative AI had become a topic of interest in the verification space, Mr Warren-Tape said verification providers had been using the same technology to generate synthetic images to train their devices.

The system was also being trained to detect the tactics of crime syndicates as they emerged.

“Identity rings are now obviously becoming more aware of how these technologies are working,” he said. “We’ve had situations where there has been the ID of a 60-year-old English lady and then there’s a very large black man holding it in a video and it has clearly been stolen in some shape or form.

“I’ve also seen a recent Indian ring who are creating fake NSW driver’s licences and putting someone else’s photo on them, taking a video of that person so the photo and likeness video match.”

One of the old school methods that never worked and was often flagged by the system involved Victorian driver’s licences.

“We see this a lot in Victorian driver’s licences. They peel the film back, put in someone else’s photo, push the film back and hope that passes, but we pick those up,” Mr Warren-Tape said.

“We see the same face on numerous different documents so we developed what we call a fraud hub which flags when you see the same image on, say, six different real documents.”